A few weeks ago, a friend of mine – let’s call her Mallory - got an unsettling call from her accountant. The accountant had been preparing Mallory’s taxes, hit “Send” to e-file the finished return, and it was rejected. Someone had already filed a tax return using Mallory’s Social Security number. She’d been a victim of tax identity theft.

The accountant called the IRS, but they wouldn’t talk to her. Mallory called and was directed to the fraud department. While she was on hold, she made more calls: one to a friend at the FBI, another to the FTC and the last one to me.

Mallory had just become a statistic. The aftermath of tax identity theft is messy, and since 2012, the number of victims has been on the rise. Millions of Americans who expected refunds—often desperately needed to make ends meet—have waited the better part of a year to get their money back – and even then only after they had traversed a paper labyrinth to prove to the IRS they had been the victims of a crime.

Like many of us, Mallory thought she was doing everything she could to protect her identity from this kind of crime and, as a former senior banking executive, she probably was. Unfortunately, we live in a world where breaches – and the resulting cases of identity theft – are rapidly becoming the third certainty in life. Doing everything we can do is no longer good enough: too many organizations have too much of your information in databases that are too easily accessed by the wrong people.

Though most people don’t know enough about this kind of crime, the IRS investigations of tax-related identity theft are up 66 percent since 2012. The agency says it has identified 14.6 million false returns and stopped $50 billion in fraudulent refunds since then, but the problem continues to grow. Victimization is so rampant that the two most popular DIY-tax software programs (H&R Block’s Tax Software and Intuit’s Turbo Tax) now offer a window for tax identity theft victims to input their IRS-issued Identity Protection PIN with their other identifying information.

So what happens if, or when, you become a victim of tax identity theft?

If you know for certain that your identity has been compromised, the IRS has a form for that. But if you’ve already lost your tax refund to an identity thief, their reporting mechanism may not be enough to resolve your existing case. If you know your information is in the hands of the bad guys, make sure you cover your bases with the IRS as well as the credit reporting agencies, the Social Security Administration and your creditors.

While the IRS knows how many thieves it caught, the Treasury’s Inspector General for Tax Administration suspects that an additional 1.1 million fraudulent returns (and $3.6 billion in refunds) slipped through IRS filters in 2011. He also reported that the agency issued $183 million in tax refunds that year to identity thieves – based on the 174,000 Social Security numbers that were used on mrel="nofollow"ultiple tax returns in 2011 – after the criminals had submitted fake returns, before legitimate taxpayers legally filed.